Description
The WhatsApp bridge component in Nanobot binds the WebSocket server to all network interfaces (0.0.0.0) on port 3001 by default and does not require authentication for incoming connections. An unauthenticated remote attacker with network access to the bridge can connect to the WebSocket server to hijack the WhatsApp session. This allows the attacker to send messages on behalf of the user, intercept all incoming messages and media in real-time, and capture authentication QR codes.
Published: 2026-02-16
Score: 10 Critical
EPSS: < 1% Very Low
KEV: No
Impact: WhatsApp session hijack
Action: Apply Patch
AI Analysis

Impact

Nanobot’s WhatsApp bridge defaults to listening on all network interfaces (0.0.0.0) and does not enforce authentication. An attacker who can reach port 3001 can connect via WebSocket, hijack the WhatsApp session, send messages as the user, intercept all inbound messages and media, and capture authentication QR codes. This vulnerability permits full control of the user’s messaging session without user credentials.

Affected Systems

The vulnerability affects Nanobot installations by HKUDS that use the default WebSocket server configuration. All versions released before the latest known fix (v0.1.3.post7) are potentially vulnerable. Current version information beyond the release tag is not provided, so any deployment using the default interface binding is at risk.

Risk and Exploitability

The CVSS score of 10 assigns critical severity, yet the EPSS score of less than 1% indicates a low likelihood of exploitation currently. This vulnerability is not yet listed in CISA’s KEV catalog, suggesting no confirmed public exploits. Nonetheless, anyone who can reach Nanobot’s WebSocket on port 3001 has a direct path to hijack a WhatsApp session, allowing message spoofing, interception, and QR‑code theft, which could compromise user confidentiality and trust.

Generated by OpenCVE AI on April 17, 2026 at 19:10 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Upgrade Nanobot to the latest release (v0.1.3.post7 or newer) that addresses the unauthenticated WebSocket interface.
  • If an upgrade is not immediately possible, restrict access to port 3001 with firewall rules, permitting only trusted hosts or the local loopback interface.
  • Verify that the WebSocket server is bound only to 127.0.0.1; if it remains bound to 0.0.0.0, reconfigure it to listen on localhost or disable the bridge when not needed.
  • Monitor logs for unauthorized WebSocket connections and consider disabling the feature if it is not required for your deployment.

Generated by OpenCVE AI on April 17, 2026 at 19:10 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Tue, 17 Feb 2026 18:15:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Mon, 16 Feb 2026 12:15:00 +0000

Type Values Removed Values Added
First Time appeared Hkuds
Hkuds nanobot
Vendors & Products Hkuds
Hkuds nanobot

Mon, 16 Feb 2026 10:15:00 +0000

Type Values Removed Values Added
Description The WhatsApp bridge component in Nanobot binds the WebSocket server to all network interfaces (0.0.0.0) on port 3001 by default and does not require authentication for incoming connections. An unauthenticated remote attacker with network access to the bridge can connect to the WebSocket server to hijack the WhatsApp session. This allows the attacker to send messages on behalf of the user, intercept all incoming messages and media in real-time, and capture authentication QR codes.
Title Nanobot Unauthenticated WhatsApp Session Hijack via WebSocket Bridge
Weaknesses CWE-306
References
Metrics cvssV3_1

{'score': 10, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N'}

Subscriptions

Hkuds Nanobot
cve-icon MITRE

Status: PUBLISHED

Assigner: tenable

Published:

Updated: 2026-02-17T16:43:29.855Z

Reserved: 2026-02-16T09:39:50.906Z

Link: CVE-2026-2577

cve-icon Vulnrichment

Updated: 2026-02-17T16:43:26.520Z

cve-icon NVD

Status : Deferred

Published: 2026-02-16T10:16:08.827

Modified: 2026-04-15T00:35:42.020

Link: CVE-2026-2577

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-04-17T19:15:26Z

Weaknesses